Formal privacy findings involving Facebook and Instagram, including international transfers, child users and security controls.
A Facebook design flaw allowed attackers to obtain access tokens affecting about 29 million accounts. The regulator found failures in breach notification, documentation and data protection by design.
View caseMeta notified the regulator that some social-media user passwords had been stored in plaintext on internal systems. The inquiry assessed notification, documentation and security obligations.
View caseThe EDPB found an ongoing infringement involving processing for behavioural advertising on the basis of contract and legitimate interests across the European Economic Area.
View caseThe Irish regulator found that Meta Ireland continued transferring Facebook users’ personal data to the United States without safeguards that addressed the risks identified by the Court of Justice of the EU.
View caseThe inquiry examined Instagram settings and the public disclosure of email addresses and phone numbers belonging to child users, including users of business accounts.
View caseThe FTC alleged that Facebook violated a 2012 privacy order by misleading users about control over their personal information and the handling of facial-recognition settings and phone numbers.
View case